Instead of installing potentially infected malware programs, why don't you just configure and install VNC correctly to run in the background? (A few cellphones can actually connect to VNC servers.)

Alternatively, use TrueCrypt to perform a full disk encryption of your harddisk with a master key or a password which he or she cannot guess. That's a proactive solution since the entire contents of your computer is encrypted if you got secret stuff on it. (Even without a harddisk he or she can just insert a Live CD though.)

Of course, the easiest way is just to put a password in BIOS and before the computer boots. But that's relatively easy to reset on most computers nowadays.

In regards to your first question, yes, you can run keyloggers with Avast installed you'd just have to go into the main interface and tell it which files and processes to exclude from malware scans. I'd probably just stick to the basics like the ones available on BT4 rather than shelling out cash for a commercial, and possibly malicious, tool. Its your own system you're installing this on so you wouldn't be overly concerned with hiding it from the anti-virus via rootkits and such.

In regards to Mark's point, while the above guidance is technically possible, it may not be the smart move, the appropriate move, or the easy move. What exactly is your main issue? If you don't want your roomy on your computer then password protect it. If you're more worried about him getting at the data on your system then start looking at encryption. (a container or whole disk) Whole disk encryption would also help keep him off the computer in general if you think he's got the skill to bypass a standard login. (via something like a live CD or bootable USB)

Do you have some reason to go the keylogger route? If your goal is to just keep him off the system there are better ways then going into spy-vs-spy mode.

Both the points above are good. I'll also point out that depending on where you live, your roommate may actually have an expectation of privacy while using your computer (if it isn't password protected, left in an open space, etc). In other words, you might be opening a whole can of worms by installing the keylogger and he uses the computer. For instance, imagine he does use the computer, he logs into his bank account (and maybe porn or whatever), you approach him about the computer use and say you have proof because you were logging his keystrokes. Two weeks later someone drains his bank account. What is he going to think?

Don't put yourself in that position. Implement one of the suggestions above steer clear of spying on him. It will only bring trouble.